×

Regional Conference on Ransomware Concludes with Cross-Sector Dialogue

04.12.2025

Image for Regional Conference on Ransomware Concludes with Cross-Sector Dialogue

The Western Balkans Cyber Capacity Centre (WB3C) hosted the regional conference Confronting Ransomware: Analysis and Strategy for the Western Balkans” on 2-3 December 2025. The event served as a platform for structured dialogue among key stakeholders from the region and international partners. The discussions were guided by Vanja Madzgalj, our Senior Project Manager, who served as the conference host, ensuring a cohesive and productive exchange of ideas throughout the two-day programme.

The conference was opened by Mr. Marash Dukaj, Minister of Public Administration of Montenegro who stressed the importance of continued development and collaboration, despite significant progress Montenegro has made over the past few years. The critical role of international cooperation was acknowledged by H.E. Anne-Marie Maskay, Ambassador of France to Montenegro, and H.E. Bernarda Gradišnik, Ambassador of Slovenia to Montenegro, highlighting the partnership that established the WB3C.

Over two days, sessions were designed to address the ransomware challenge from distinct professional viewpoints.

Day 1: Understanding the Threat and Response Mechanisms

  • Panel 1: The Operational Threat Landscape. This session provided a technical and strategic overview of ransomware from national and private sector perspectives.
    • Moderator: Igor Kovač, Government Information Security Office of Slovenia (URSIV).
    • Panelists: Dušan Polović (Ministry of Public Administration, Montenegro), Saimir Kapllani (National Cyber Security Authority, Albania), Predrag Puharić (Cyber Security Excellence Centre, BiH), and Mladen Bukilić (Čikom, Montenegro).
    • Key Discussion: The panel detailed the current scale and methods of attacks, emphasizing the need for shared threat intelligence. They looked at how ransomware has been evolving in the recent years and how governments and private sector are preparing for to prevent and respond growing threats. Disparity in defensive resources, especially sophisticated AI capabilities, affects overall organizational esilience.
  • Panel 2: Law Enforcement Perspective on Cybercriminal Organizations. This panel focused on the investigative viewpoint, examining the structure and operations of ransomware groups.
    • Moderator: Francisco Losada, Cybercrime Specialist, EUROPOL.
    • Panelists: Julien Hamm (Anti-cybercrime Office (OFAC), France), Nenad Bogunović (High-Tech Crime Unit, Ministry of Interior, Serbia), and Sreten Ćorić (High-tech Crime Unit, Police Directorate of Montenegro).
    • Key Discussion: Experts outlined the sophisticated, business-like models of cybercriminal groups. Challenges highlighted included the cross-jurisdictional nature of investigations and the constant evolution of adversarial tactics, which require continuous adaptation and closer international police collaboration.
  • Keynote Presentation: A Law Enforcement Blueprint. Captain Pascal Martin of the French Gendarmerie delivered a keynote address, decrypting a successful operation against a ransomware network. His presentation provided a concrete blueprint for combining digital forensics, international judicial cooperation, and public-private intelligence sharing to achieve tangible results.
  • Case Study: The Private Sector Response. Vladimir Mlynar, CISO for VINCI Energies CEE, presented a detailed case study from the private sector. He walked through the operational timeline of a real-world ransomware incident, offering insights into crisis management, communication challenges, and recovery strategies under pressure.
  • Panel 3: The Legal and Jurisdictional Framework. This discussion explored the judicial and prosecutorial challenges in combating ransomware.
    • Moderator: Ana Bukilić, International Development Law Organisation (IDLO).
    • Panelists: Aurélien Brouillet (Deputy Prosecutor, Judicial Court of Paris), Marina Barbir (Judge, Higher Court of Belgrade), and Ivaylo Iliev (Assistant to the National Member for Bulgaria, EUROJUST).
    • Key Discussion: The conversation centered on the complexities of applying national laws to transnational cybercrime. Key challenges involve harmonizing legal standards for evidence collection, ensuring effective prosecutions, and streamlining formal international cooperation channels to keep pace with the speed of cyber incidents. The need for training in digital forensics for prosecutors and judges was emphasized as key in advancing judicial response in cases involving digital evidence and other sophisticated technologies.  
  • Special Session: Technical and Legal Aspects of Cryptocurrency Seizure. This exchange focused on the financial dimension of ransomware response.
    • Participants: Laurent Tisseyre (TRM Labs) and Dr. Arben Murtezić (Legal Counsel and Law Professor).
    • Key Discussion: The dialogue between a technical analyst and a legal expert underscored the difficulty of tracing and immobilizing illicit cryptocurrency payments. Challenges include the need for specialized blockchain forensic tools and navigating varied national regulations for asset seizure and recovery.

Day 2: Evolving Tactics and Crisis Management

  • Panel 1: The Impact of Artificial Intelligence. This session assessed AI's dual role in both advancing threats and empowering defenses.
    • Moderator: David Toulotte, Cyber reservist, Head of Global IT @ ArcelorMittal Europe.
    • Panelists: Mitja Trampuž (Creaplus/ai4si, Slovenia), Ivan Bošković (IT Advanced Services, Montenegro), and Prof. Dimitar Bogatinov (Military Academy, Skopje).
    • Key Discussion: Panelists explored how AI lowers barriers for executing more persuasive and adaptive attacks. A significant challenge is the rapid adoption of AI systems without corresponding security safeguards, creating new vulnerabilities even as AI offers new tools for cyber defense. Constant advancement of attacks forces defenders to also develop faster. The conclusion of the panel was that AI is here to stay, as one of the greatest inventions of man.
  • Panel 2: Incident Response and Negotiation Dynamics. This panel addressed the critical decision-making processes during an active ransomware attack.
  • Presentation: Resilience at Scale. Jérémy Couture, former Head of Cybersecurity for the Paris 2024 Olympic Games, provided a unique testimony on defending a hyper-complex, global target. His presentation on managing extreme-scale threats and stakeholder coordination offered critical lessons for national and corporate resilience planning.
    • Moderator: Gilles Schwoerer, Head of WB3C.
    • Panelists: Jean-Dominique Nollet (CISO, TotalEnergies) and Captain Pascal Martin (French Gendarmerie).
    • Key Discussion: The session covered the operational, legal, and ethical complexities of ransom negotiations. The main challenges discussed were balancing incident containment, legal obligations, and business continuity under severe pressure, all while coordinating with law enforcement investigations.

The conference facilitated a substantive exchange of perspectives from law enforcement, the judiciary, the private sector, and policy makers. The discussions reinforced that an effective response to ransomware requires continuous, practical collaboration across these sectors and borders, with a focus on addressing shared challenges in capacity, legislation, and joint operations.  The highly engaged audience, whose numerous questions created a dynamic, two-way conversation deepened the value of each session.  We thank all the speakers and participants for their great contribution to this conference and our Project Manager Maja Miranovic for putting together this great event. 

Check out event photos here: 

https://www.jaredic.com/p467614661 (day 1)

https://www.jaredic.com/p549115929 (day 2)


WB3C and the Centre for Education of Judges and Prosecutors of the Federation of Bosnia and Herzegovina Deliver Cybercrime Training in Sarajevo

Following last week's cybercrime training for police officers in Banja Luka, the Western Balkans Cyber Capacity Centre (WB3C) continued its outreach programme in Bosnia and Herzegovina this week with a specialised training for prosecutors and judges in Sarajevo, 22-24 June 2026.

Delivered in cooperation with the Centre for Education of Judges and Prosecutors of the Federation of Bosnia and Herzegovina (CEST FBiH), the programme brought together judicial practitioners to strengthen their understanding of cybercrime, digital evidence, open-source intelligence (OSINT), blockchain technologies and cryptocurrencies. Through a combination of expert-led sessions and practical exercises, participants explored the legal, procedural and evidentiary challenges that increasingly accompany cybercrime cases.

The Sarajevo training builds on the police-focused programme delivered in Banja Luka the previous week and forms part of a broader capacity-building effort developed jointly with institutions across Bosnia and Herzegovina. Following extensive consultations with both the Centre for Education of Judges and Prosecutors of the Federation of Bosnia and Herzegovina and the Ministry of Interior training structures in Republika Srpska, WB3C designed a tailored programme reflecting the specific needs and operational realities of the country's criminal justice system.

Cybercrime investigations require effective cooperation between investigators, prosecutors and judges. By supporting capacity development across the entire criminal justice chain, WB3C seeks to contribute to a more coordinated and effective response to cybercrime in Bosnia and Herzegovina.

A Young Engineer Journey - AI Student from Lille on Internship Programme in Podgorica

At 21, Tom Husson has already learned something that many professionals discover much later: education does not stop at the classroom door.

Tom is a fourth-year Artificial Intelligence student at ISEN Lille, one of France's leading engineering schools. As part of his degree, he is spending a full year outside the traditional academic environment — combining a six-month industry internship with an international experience designed to expose students to different cultures, challenges and ways of working.

Before arriving in Montenegro, Tom spent two months in South Africa, living with a local family and helping with daily chores in exchange for accommodation and meals. In May, his journey brought him to Podgorica.

This opportunity was enabled by the whole ecosystem of players. It was prompted by WB3C's programme director Gilles Schwoerer, and Tom indeed feels at home at WB3C where he spends a lot of time working. Further, Naučno-tehnološki park Crne Gore / Science Technology Park of Montenegro kindly agreed to sign an internship contract, but it is thanks to Ivan Boskovic, ITAS CEO, that Tom has been granted this valuable 3-month experience along with the ongoing mentorship that Ivan provides as a seasoned tech professional working with AI driven technologies.

The project aims to transform the way hotels interact with guests by automating bookings, handling enquiries, solving everyday issues and supporting hotel operations in real time. Information generated by the system is fed directly to hotel managers, enabling faster decision-making and improved customer service.

Beyond improving existing functionalities, Tom is also exploring one of the most important questions facing AI today: how to protect intelligent systems from malicious inputs and external manipulation. His research touches on the intersection of artificial intelligence and cybersecurity — a field that is becoming increasingly important as AI systems gain greater autonomy.

For ITAS, the collaboration brings fresh ideas, research capacity and a direct link to the latest developments coming from one of Europe's strongest engineering ecosystems.

For Tom, it is something equally valuable: the opportunity to apply theory in practice, work alongside experienced professionals and build the skills that employers increasingly seek.

This opportunity emerged through an unexpected connection. Tom's father, an officer in the French Gendarmerie, visited Podgorica in 2024 during a regional cybersecurity conference and met representatives of WB3C. A conversation that started there eventually helped connect his son with an internship opportunity a year later.

With the support of Science and Technology Park Montenegro, WB3C and ITAS, Tom has become part of an ecosystem that brings together education, innovation and industry.

His story also highlights something larger.

Lille, where Tom studies, is home to one of Europe's most dynamic cybersecurity communities and hosts the annual Forum InCyber Europe, one of the continent's leading cybersecurity gatherings. WB3C has participated in the forum twice, bringing public and private sector representatives from across the Western Balkans to connect with industry leaders, explore innovation and build partnerships.

These experiences continue to inspire our own ambitions for the region.

Because talent grows fastest when education, industry and international cooperation work together.

And sometimes, that journey starts with a student willing to leave home and embrace the unknown.

 

The ITAS Perspective: Why Investing in Young Talent Matters

The pace of technological development has created an ever-widening gap between what young professionals learn through formal education and what is expected of them when they enter their first jobs. This is especially visible in fields such as artificial intelligence and cybersecurity, where tools, methods and business needs evolve faster than traditional curricula can adapt. That is why companies have an important role to play — as a bridge between academic knowledge and state-of-the-art practice.

This year, ITAS piloted a small but meaningful concept: bringing together students from economics and electrical engineering with an international student from France. The idea was to create a multidisciplinary and multicultural working environment, closer to what young people will encounter tomorrow in real professional life — where engineers, business thinkers, researchers and international teams work side by side.

The result exceeded our expectations.

By opening real projects to students, sharing current technological challenges and exposing them to the way modern teams actually work, we help them build the confidence, adaptability and practical understanding that junior professionals increasingly need. At the same time, our company gains fresh perspectives, curiosity and research energy, while educational institutions receive valuable feedback from the real economy — helping them keep pace with technologies that change faster than traditional systems can adapt.

Tom’s journey from Lille to Podgorica is an example of how growth often happens outside familiar environments. International experience teaches young people independence, adaptability and openness. Practical work teaches them responsibility, teamwork and problem-solving.

In a world where knowledge becomes outdated quickly, schools, universities and companies are jointly challenged to shape curricula, adapt learning modules and expose students to real projects much earlier.

Because talent develops fastest when it is trusted, challenged and connected to the real world.

IT Advanced Services — ITAS is a Montenegrin technology company focused on software development, digital transformation and the practical application of artificial intelligence. Based in Podgorica, ITAS develops solutions for different sectors, including healthcare, tourism, hospitality, finance, e-commerce and public services.

A growing part of the company’s work is dedicated to AI research and applied innovation. ITAS is developing projects in digital pathology and medical image analysis, AI-supported hospitality solutions, data-driven fraud and risk detection, process automation and intelligent business systems. The company combines software engineering, domain knowledge and research-oriented development to create practical solutions with real market and social value.

 

Critical Information Infrastructure Protection

What happens when a cyber incident in one organisation starts affecting everyone else?

This week at WB3C, professionals responsible for critical infrastructure from across the Western Balkans worked through that question during an intensive training on Critical Information Infrastructure Protection (CIIP). The programme focused not on theory, but on practical decision-making: identifying critical assets, mapping dependencies, assessing risks, developing mitigation measures and managing large-scale cyber crises through simulation exercises.
The training was delivered by experts from the Dutch National Cyber Security Centre (Nationaal Cyber Security Centrum (Nationaal Cyber Security Centrum (NCSC-NL), bringing operational experience from the frontline of protecting critical infrastructure and essential services. Participants worked through real-world scenarios, explored cross-sector dependencies and developed concrete action plans applicable to their own institutions and national contexts.
As digitalisation accelerates, the resilience of critical infrastructure is becoming a shared responsibility that extends far beyond the cybersecurity community. Strengthening cooperation between governments, operators of essential services, regulators and experts is no longer optional—it is a prerequisite for continuity and security.
The Western Balkans Cyber Capacity Centre (WB3C) is proud to have hosted this activity in partnership with the Dutch National Cyber Security Centre.
This training was funded by the Kingdom of the Netherlands.
 


Copyright © WB3C

Disclaimer: Translations of the original content written in English into other languages are AI generated by Weglot.